Who watches the watchers - if not their own conscience?
It is incumbent upon the honorable craftsman
to be aware of whether or not his services are being used
as a means to accomplish evil ends -
and to act accordingly.
Our employees would do well to review, AND EMBRACE, the American First Principles - written in stone here:
"TO SECURE THESE RIGHTS, governments are instituted among men"
"I HAVE SWORN UPON THE ALTAR OF GOD ETERNAL HOSTILITY TO EVERY FORM OF TYRANNY OVER THE MIND OF MAN"
--Thomas Jefferson
JULY 31?, 2010 THU : (NJ : MAN , JACOB APPLEBAUM, IS [ALLEGEDLY] SEARCHED AT NEWARK AIRPORT IN CONNECTION WITH WIKILEAKS INVESTIGATION ; HE IS A PROGRAMMER FOR AN ONLINE PRIVACY PROTECTION PROJECT CALLED TOR——see SEATTLE, TOR, INTERNET) ———“Researcher detained at U.S. border, questioned about Wikileaks”by Elinor Mills, LAS VEGAS —, July 31, 2010 4:16 PM PDT
http://news.cnet.com/8301-27080_3-20012253-245.html
I have used Tor, and OpenDNS, for years. Very good products.
The article leaves out the pitfalls, though, and there are some that anyone who uses, not just Tor but, any security product, really needs to know.
Want Tor to really work?
...then please don't just install it and go on. You need to change some of your habits, and reconfigure your software! Tor by itself is NOT all you need to maintain your anonymity. There are several major pitfalls to watch out for:
1. Tor only protects Internet applications that are configured to send their traffic through Tor — it doesn't magically anonymize all your traffic just because you install it. We recommend you use Firefox with the Torbutton extension.
2. Torbutton blocks browser plugins such as Java, Flash, ActiveX, RealPlayer, Quicktime, Adobe's PDF plugin, and others: they can be manipulated into revealing your IP address. For example, that means Youtube is disabled. If you really need your Youtube, you can reconfigure Torbutton to allow it; but be aware that you're opening yourself up to potential attack. Also, extensions like Google toolbar look up more information about the websites you type in: they may bypass Tor and/or broadcast sensitive information. Some people prefer using two browsers (one for Tor, one for non-Tor browsing).
3. Beware of cookies: if you ever browse without Tor and a site gives you a cookie, that cookie could identify you even when you start using Tor again. Torbutton tries to handle your cookies safely. CookieCuller can help protect any cookies you do not want to lose.
4. Tor anonymizes the origin of your traffic, and it encrypts everything between you and the Tor network and everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication. HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites.
5. While Tor blocks attackers on your local network from discovering or influencing your destination, it opens new risks: malicious or misconfigured Tor exit nodes can send you the wrong page, or even send you embedded Java applets disguised as domains you trust. Be careful opening documents or applications you download through Tor, unless you've verified their integrity.
6. Tor tries to prevent attackers from learning what destinations you connect to. It doesn't prevent somebody watching your traffic from learning that you're using Tor. You can mitigate (but not fully resolve) the risk by using a Tor bridge relay rather than connecting directly to the public Tor network, but ultimately the best protection here is a social approach: the more Tor users there are near you and the more diverse their interests, the less dangerous it will be that you are one of them.
Be smart and learn more. Understand what Tor does and does not offer. This list of pitfalls isn't complete, and we need your help identifying and documenting all the issues.
Learn More at TOR
